Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
This rule detects attempts to mitigate the CVE-2026-31431 vulnerability by either unloading the 'algif_aead' kernel module using 'rmmod' or by configuring 'modprobe' to blackhole the 'algif_aead' module. This activity indicates a system administrator or automated tool is applying a known mitigation for a kernel vulnerability.
Detects commands used to disable or unload the 'algif_aead' kernel module. This activity is the recommended emergency mitigation for the "Copy Fail" vulnerability (CVE-2026-31431). Monitoring this ensures visibility into mitigation deployment across infrastructure and helps identify unauthorized tampering with kernel cryptographic capabilities.
Detects alerts generated by page-cache integrity checking tools (e.g., pagecache_diff.py) indicating a divergence between a file's in-memory page cache and its on-disk representation. This is a primary post-exploitation indicator for the Copy Fail vulnerability (CVE-2026-31431), which corrupts the page cache without modifying the physical file to bypass traditional File Integrity Monitoring (FIM).
Detects administrative actions to disable or unload the 'algif_aead' kernel module. Monitoring for this activity helps defenders verify successful automated deployment (e.g., via Ansible) of the recommended security fix for CVE-2026-31431 (CopyFail).
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
Detects attempts to query, stop, or disable the legacy UI0Detect (Interactive Services Detection) service using the 'sc.exe' utility. This behavior was observed in the Lotus Wiper destructive campaign to suppress interactive service warnings before wiping the system.
Detects command-line registry modifications that explicitly enable anonymous LSA enumeration. This action can lower the environment's security posture and aid in internal network discovery, a technique observed in operations like The Gentlemen RaaS.
Detects the use of the Add-MpPreference cmdlet to add the root C:\ drive to the Windows Defender exclusion path. Attackers and ransomware families, such as The Gentlemen, use this technique to completely blind Windows Defender to malicious file activity during the encryption process.
Detects the use of esxcfg-advcfg to alter the BufferCache settings (MaxCapacity or FlushInterval) on an ESXi host. This activity is often associated with ransomware variants like Gentlemen ransomware, which modify these settings to prepare the storage layer for fast, reliable bulk file encryption.
This rule detects the execution of a Linux process where the command line contains environment variables related to dynamic linker debugging (LD_AUDIT, LD_DEBUG, or LD_DEBUG_OUTPUT). These variables can be abused by adversaries to load malicious libraries, bypass security controls.
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
Detects the execution of the Set-MpPreference PowerShell cmdlet to disable Windows Defender real-time monitoring. This technique is frequently abused by malware and ransomware affiliates, such as The Gentlemen RaaS, to bypass endpoint defenses prior to payload detonation.
Detects command-line registry modifications that enable 'EveryoneIncludesAnonymous' or disable 'RestrictAnonymous' in the Local Security Authority (LSA) configuration. Attackers may perform these actions to lower the environment's security posture, explicitly allowing anonymous LSA enumeration, which aids in internal network discovery.
This rule detects attempts to remove AppArmor profiles on Linux systems. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
This rule detects when critical services, including security agents, backup solutions, and remote management tools, are stopped on a host. Adversaries often stop these services to evade detection, disable security controls, or inhibit system recovery during attacks like ransomware.
Detects the execution of bcdedit.exe to disable the Windows Recovery Environment or ignore boot failures. This is a common pre-encryption technique used by Kyber ransomware to prevent defenders from restoring the OS.
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Detects the execution of a specific command line utilizing tasklist and taskkill to identify and terminate msedge.exe processes that do not have CoreUIComponents.dll loaded. This defense evasion technique is heavily utilized by UNC6692 via scheduled tasks to clean up headless Microsoft Edge processes executing their SNOWBELT malware.
Detects attempts to query, stop, or disable the legacy Interactive Services Detection (UI0Detect) service using the 'sc.exe' utility. This technique was observed in the Lotus Wiper destructive campaign to suppress interactive service graphical warnings before executing its wiper payload.
Detects registry modifications aimed at disabling critical Windows utilities (Task Manager, Registry Editor) or degrading the user interface (swapping mouse buttons, hiding desktop icons). These behaviors are indicative of the CrystalX 'Rofl' prankware and disruption module.
Page 29 of 60